> It's an argument that CAP_SYS_BOOT is too powerful yes, but if you > recall, I said I keep that one. In the rather lame analogy, what I do > by giving away CAP_SYS_MODULE and enforcing module signing while keeping > CAP_SYS_BOOT is allow people into my conservatory to play with the > plants but not into my house to steal the silver ... saying CAP_SYS_BOOT > is too powerful doesn't affect that use case because I haven't given > away CAP_SYS_BOOT.
Ok, sorry, I had your meaning inverted. Yes, permitting the loading of signed modules while preventing the use of kexec is a completely reasonable configuration - so reasonable that it's what this patch causes the kernel to do automatically. -- Matthew Garrett <matthew.garr...@nebula.com>
